Subject: Digital Forensics

Topic: Preserving and Recovering Digital Evidence

Difficulty: Medium

1. With proper search warrants, law enforcement can seize all computing systems and peripherals.

2. In corporate investigations, you might have similar authority; however, you might have the authority only to make an image of the suspect’s drive.

3. Depending on company policies, corporate investigators rarely have the authority to seize all computers and peripherals.

4. When seizing computer evidence in criminal investigations, follow the U.S. DOJ standards for seizing digital data. For civil investigations, follow the same rules of evidence as for criminal investigation. In a criminal matter, investigators seize entire drives to preserve as much information as possible and ensure that no evidence is overlooked. If you have any questions, doubts, or concerns, consult with your attorney for additional guidance.